The record.

Attackers spent months cultivating the team, then used Solana durable nonces to get Security Council members to pre-sign transactions handing over administrative control. They whitelisted a worthless token as collateral at an invented price, deposited 500 million of it, and withdrew real USDC, SOL and ETH. The withdrawal ran twelve minutes.

Thirty-one transactions against one protocol in twelve minutes is a rate, and a rate is what a velocity rule is for. Detection fires on the first few; the armed Circuit Breaker caps outflow per window at a ceiling the treasury set, so the rest revert at your own entrypoint.

It takes more than one wall. Ops Monitor sees the administrative handover as it happens, and an Asset Ratings floor read at collateral onboarding refuses a token with no verifiable structure. Any one narrows this; all three stop it.

A rounding inconsistency in the pool invariant maths let an attacker suppress pool-token prices and extract value through repeated arbitrage. A single swap loses a negligible amount; sixty-five batched into one transaction compound into a drain. It ran across six networks in under half an hour, and copycats hit unpatched forks.

One transaction of sixty-five internal operations that leaves the pool worse off is a value-conservation failure, checked inside the transaction rather than alerted after it. The Circuit Breaker reverts it at the venue's own entrypoint. The shared threat graph means a pattern seen on one deployment is already known to every fork.

An overflow check in a shared maths library failed to reject values above its limit. The attacker flash-loaned, opened a position in a very narrow price range, and added one unit of a token. The overflow reset the calculation to a far smaller number, crediting liquidity worth millions against a deposit of one.

The check that matters is arithmetic and local: liquidity minted must be consistent with tokens actually supplied, in the same transaction. Stated as an invariant on the venue's entrypoint, the Circuit Breaker reverts the mint. No off-chain pipeline is fast enough here, and we do not claim one is.

A former employee's package account was phished, and the attacker published malicious versions of a library loaded by hundreds of dApp front ends. The injected code asked users to sign approvals and transfers routed to the attacker. Every dApp was legitimate, every domain correct, every hardware wallet working as designed.

There is exactly one place to catch this: between confirm and signature, by reading what the transaction actually does. A pre-signature verdict returns block on an unlimited approval to an address first seen minutes ago, with a reason the wallet renders in plain language.

An upgrade added a function that reduced the caller's own collateral without running the solvency check every other fund-moving function ran. The attacker flash-loaned, used the donation to push their position into insolvency, then self-liquidated it at a discount and collected the difference.

No alerting pipeline can interrupt one transaction: there is no gap between the first step and the last to send a message into. The only thing that stops this is a check inside the same transaction, in a contract the venue itself calls. That is the Circuit Breaker, and it works with Fuga Labs offline.

Of the 116,500 rsETH taken from the Kelp DAO bridge, 89,567 was deposited straight into Aave as collateral and borrowed against for $190M of WETH. Aave's contracts were never touched. Aave, SparkLend and Fluid all froze their rsETH markets; at least nine protocols were affected.

Proof of backing is measured on chain for wrapped and bridged assets: minted supply against verifiable backing, continuously. The moment supply outruns backing, every market holding that asset is downstream of a fact the graph already knows, and the look-through query answers who is exposed and for how much.

It takes more than one wall. The clearest case for the compounding argument. Ops Monitor sees the cause, Asset Ratings would have refused the structure, and Exposure Map tells the nine protocols downstream what it costs them.

Stream Finance disclosed a $93M loss and froze withdrawals. Elixir's deUSD had lent roughly sixty-five per cent of its backing to Stream through private lending vaults; it fell about ninety-eight per cent and was wound down. Some lending markets had hard-coded the affected collateral at a dollar, so positions could not be liquidated and the bad debt stayed invisible.

This is the look-through question. A deUSD holder held a claim on a loan to a fund manager, two steps removed, and the graph follows the chain of claims to the bottom rather than stopping at the wrapper. Where a price is an assumption rather than a measurement, the surface says so in the same type as the number.

The protocol priced an asset as the median of eleven sources, which reads as robust. Five of those eleven were Curve pools holding the same pair family, and one flash loan moved all five at once. The median followed, borrowing opened at a manipulated price.

Independence is a property of the graph, not of a count. Reading each source back to the venue state it derives from shows five of eleven collapsing to one dependency. Depth is measured from live venue state, so the cost of moving those pools is a number rather than an assumption.

A reentrancy lock that silently did nothing in three versions of the Vyper compiler let attackers drain several stable pools. The direct loss was not the dangerous part: Curve's founder had pledged roughly 427 to 460 million CRV, close to half the circulating supply, against more than $100M of debt across Aave, FraxLend, Abracadabra, Inverse and Silo.

The exposure at risk was a multiple of the amount stolen, and it sat on balance sheets belonging to protocols the exploit never touched. Contagion order answers which of those five markets becomes unhealthy first and at what price; exit depth answers what liquidating into the thinnest book of the year would cost.

The attacker used Alpha Homora's leveraged lending to borrow and lend repeatedly against Iron Bank, then walked away. Alpha Homora was the protocol with the flaw. Iron Bank was left holding the debt, and it had done nothing wrong at all.

Two protocols were coupled by a credit line most people reading either dashboard could not see. That coupling is an edge in the graph, carrying its source contract, chain, block and read time, so who is downstream of whom is answered from chain state rather than a vendor's feed.

An attacker reached the dashboard driving an autonomous agent and queued two malicious replies. The agent processed them as legitimate instructions and used its own tipping feature to send 55.5 ETH to the attacker. The model was not broken and the code was not exploited. The agent was persuaded.

A destination allowlist and a per-operation ceiling are arithmetic. They do not read the instruction, weigh how convincing it was, or have an opinion about whether the dashboard was authentic. An address the agent has never paid waits out a cooling-off window, and anything above the cap reverts.

An agent held a prize pool with one instruction: under no circumstances transfer the money. Anyone could pay to try to change its mind. 195 participants sent 481 messages and every one failed. The 482nd presented itself as a new administrative session, told the agent to drop its refusal language, and redefined what its own functions meant.

That instruction was explicit, unambiguous, adversarially tested in public by hundreds of people, and it held 481 times. It was still not a control. A cap enforced by a contract has no 482nd message; it has a comparison that either passes or reverts, checked before the operation executes.

A vulnerability in the message layer the trading bot trusted let an attacker initiate transfers from the wallets of users who had authorised it. The transfers were manual and the targets chosen, which is why eleven experienced traders lost $3M rather than everyone losing a little.

Software that spends money on your behalf needs a ceiling it cannot exceed, whether the instruction came from you or from someone impersonating you. Per-operation caps, rolling velocity limits by hour and by day, and a recipient allowlist bound the damage to a number you chose in advance. The kill switch is one transaction, immediate, and yours.

A new router contract shipped without the permission and parameter checks the old one had. Three days later an attacker used a call injection against it to spend the token approvals users had already granted, and swapped the proceeds out through a mixer.

The exposure was never the bot's balance, it was the standing approvals pointed at it. Allowlisting which contracts and which specific functions an automated operator may call turns a blanket approval into a bounded one, and session authority expires rather than persisting until somebody revokes it.

The bot's router contract lacked the permission and parameter checks that would have stopped an arbitrary call, and an attacker used it to spend users' pre-approved tokens. 280 ETH left. The team refunded 610 ETH across 106 addresses.

Two bots, one week apart, the same missing check, and in both cases users had done nothing except grant an approval to software they had reason to trust. Enforcement belongs where a compromised operator cannot argue with it: checked before the operation executes, against a policy the venue can read.